Windows Driver Stack Overflow Protection Cracked
- Jan 12, 2011 3:50 PM EST
- [num] Comments
Researchers Matthew "j00ru" Jurczyk and Gynvael Coldwind have published a paper demonstrating that stack cookies in Windows drivers can be made predictable. The result is that privileges can be elevated.
The video below demonstrates exploitation on Windows XP.
Stack cookies are data places in function stacks to detect stack overflows. In Microsoft compilers they are invoked with the /Gs switch, and are therefore also called GS cookies in the paper. The creation of the cookies employs entropy sources to create randomness and prevent attackers from guessing the cookie value, which would allow them to hijack the return address.
The entropy sources used in GS cookies in most Windows device drivers, both Microsoft and 3rd party, are weak. The authors of the paper claim to be able to guess cookie values, and therefore exploit stack overflows, with 50% success.
The researchers say they informed Microsoft of the problem. Microsoft acknowledged the problem and said that they would fix it in the next version of Windows. They did not dissuade the authors from publishing their paper on schedule. The paper includes suggested improvements to GS cookies, as well as potential attacks against those improvements.